CVE-2026-19968

Name	CVE-2026-19968
Description	A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ee77bb09a42a49843ac85ef64c14d2328b251df1. Applying a patch is advised to resolve this issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1145890

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
assimp (PTS)	bookworm	5.2.5~ds0-1	vulnerable
	trixie	5.4.3+ds-2	vulnerable
	forky, sid	6.0.5+ds-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
assimp	source	(unstable)	(unfixed)			1145890

Notes

[trixie] - assimp <no-dsa> (Minor issue)
[bookworm] - assimp <postponed> (Minor issue)
https://github.com/assimp/assimp/issues/6630
https://github.com/assimp/assimp/pull/6717
https://github.com/assimp/assimp/commit/c39d8c15dbbe03174af61d8eedbbf90120f4eb9f
https://github.com/assimp/assimp/commit/0f6bcfe7acd4c16bc198560db1be848757f953a8
https://github.com/assimp/assimp/commit/924bb602e387e10ca7c64acaac83a26d6ad1d8c6